Privacy policy

Last updated: 29 October 2026

In short: no ads, no tracking, no analytics. The only cookies are the ones that keep you logged in.

Who is responsible

Pfpair is run by Sebi. For anything about your data, a question, a copy, a correction or deletion, message @aquaxs on Telegram.

Hosting (Vercel)

This site is hosted by Vercel Inc. (USA), which processes connection data (IP address, time, requested page, browser) to deliver the site and protect it against abuse. Legal basis: legitimate interest, Art. 6(1)(f) GDPR. Vercel is certified under the EU-US Data Privacy Framework; Vercel's privacy policy applies.

Login with Discord

You can browse and download without an account. If you log in, Discord sends Pfpair your Discord ID, display name and avatar. These are stored with your profile so your posts and favourites belong to you. You can change your name, username, bio, profile picture and banner in the settings; they are public on your profile. When you favourite a post, its uploader sees your name in their inbox. Legal basis: Art. 6(1)(b) GDPR (providing your account). Discord's privacy policy applies to the login itself.

Database and storage (Supabase)

Accounts, posts, favourites, inbox messages, reports and uploaded images are stored with Supabase Inc. (USA), which runs the database, login and file storage for Pfpair. Supabase relies on standard contractual clauses for transfers; Supabase's privacy policy applies.

Uploads and the content filter

Images you upload are public once approved, together with the title, tags, credit and your display name. Before that, each image is checked for sexual content by an automatic filter (the open-source NSFWJS model) that runs inside Pfpair on Vercel, so the image is not sent to any other service for this. Legal basis: legitimate interest in keeping the site free of NSFW content, Art. 6(1)(f) GDPR.

Reports

When you report a combo you can leave an email address so we can tell you what we decided. It is only used for that and deleted once the report is closed.

Cookies

Logging in sets cookies that keep your session. They are technically necessary, so there is no cookie banner. Without logging in, no cookies are set.

Your rights

You can ask for access, correction, deletion, restriction, a copy of your data and object to processing based on legitimate interest (Art. 15–21 GDPR) by messaging @aquaxs on Telegram. You can delete your account yourself in the settings; this removes your profile, posts, favourites and messages. You can also complain to a data protection authority; in Austria that is the Datenschutzbehörde (dsb.gv.at).